mirror of https://github.com/SHOGGOTH-SECTOR/sica-fondt.git synced 2026-08-01 00:23:15 +00:00

Consolidate 22 sibling repos into layered organism structure

Place useful parts of the surrounding repos into sica-fondt by layer, per the
body model (Ada = membrane; brain/endocrine/capabilities/knowledge non-Ada):

- brain/        LLM reasoning + providers (dapr, hermes, MoMoA)
- capabilities/ REPRAG sidecars: hermes tools/skills, dapr tools, parallel
                dispatch, A51 channels, and the OSINT cluster
- knowledge/    LORAG corpus: 754 cyber-skills, agency personas, secure-coding,
                MITRE ATT&CK data
- reference/    defensive threat-reference (C3, shhbruh doc) + AdaYaml parser

License handling: AGPL sources (worldosint, advanced_evolution, mercury,
Reticulum) and GPL DeTTECT are SPEC-only clean-room/port descriptions — no
copyleft code copied. MIT/Apache/data parts copied as working trees.

Safety: shhbruh escape/persistence material and C3 covert-C2 kept as reference
only, not wired into the running organism. See CONSOLIDATION.md.

https://claude.ai/code/session_01UehUqEXXJJCsHoA4voCU5c

2026-06-10 06:53:01 +00:00

3.1 KiB

Raw Blame History

name

description

domain

subdomain

Implementing End-to-End Encryption for Messaging

Overview

End-to-end encryption (E2EE) ensures that only the communicating parties can read messages, with no intermediary (including the server) able to decrypt them. This skill implements a simplified version of the Signal Protocol's Double Ratchet algorithm, using X25519 for key exchange, HKDF for key derivation, and AES-256-GCM for message encryption.

When to Use

When deploying or configuring implementing end to end encryption for messaging capabilities in your environment
When establishing security controls aligned to compliance requirements
When building or improving security architecture for this domain
When conducting security assessments that require this implementation

Prerequisites

Familiarity with cryptography concepts and tools
Access to a test or lab environment for safe execution
Python 3.8+ with required dependencies installed
Appropriate authorization for any testing activities

Objectives

Implement X25519 Diffie-Hellman key exchange for session establishment
Build the Double Ratchet key management algorithm
Encrypt and decrypt messages with per-message keys
Implement forward secrecy (compromise of current key does not reveal past messages)
Handle out-of-order message delivery
Implement key agreement using X3DH (Extended Triple Diffie-Hellman)

Key Concepts

Signal Protocol Components

Component	Purpose	Algorithm
X3DH	Initial key agreement	X25519
Double Ratchet	Ongoing key management	X25519 + HKDF + AES-GCM
Sending Chain	Per-message encryption keys	HMAC-SHA256 chain
Receiving Chain	Per-message decryption keys	HMAC-SHA256 chain
Root Chain	Derives new chain keys on DH ratchet	HKDF

Forward Secrecy

Each message uses a unique encryption key derived from a ratcheting chain. After a key is used, it is deleted, ensuring that compromise of the current state does not reveal previously sent/received messages.

Security Considerations

Delete message keys immediately after decryption
Implement message ordering and replay protection
Use authenticated encryption (AES-GCM) for all messages
Protect identity keys with device-level security
Verify identity keys out-of-band (safety numbers)

Validation Criteria

X25519 key exchange produces shared secret
Messages encrypt and decrypt correctly between two parties
Different messages produce different ciphertexts
Forward secrecy: old keys cannot decrypt new messages
Out-of-order messages can be decrypted
Tampered messages are rejected by authentication

3.1 KiB Raw Blame History